
UNITED STATES DF \RTMENT OF COMMERCE 
Patent and Trademf i Office 

Address: COMMISSION^ or PATENTS AND TRADEMARKS 
Washington. D.C. 20231 




APPUCATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



Ov/0 1 /99 Z Ib.bb 



r 



r E r< R Y J I A [- h 0 K D 
BAKER BOTTS 
2001 RiJSS AVENUE 
DALLAS T.X 75201 "2980 



062S91 « 0:^:40 



EXAMINER 



DAM, 



ART UNIT 



PAPER NUMBER 



21 22 
DATE MAILED: 



07/24./01 



Please find below and/or attached an Office communication concerning this application or 
proceeding. 



Commissioner of Patents and Trademarlcs 



PTO-90C (Rev. 2/95) 

'U.S. GPO: 2000-473.000/44602 



1- File Copy 



Office Action Summary 



Application No. 
09/241,823 



Applicant(s)^ 

Zlese 



Examiner 

Tuan Q. Dam 



Art Unit 

2122 




- TTje MAILING DATE of this communication appears on ttie cover sheet with the correspondence address - 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE _3 MONTH{S) FROM 

THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136 (a). In no event, however, may a reply be timely filed 

after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply vflthin the statutory minimum of thirty (30) days will 

be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this 

communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 

earned patent term adjustment. See 37 CFR 1 .704(b). 
Status 

1 ) Responsive to connnnunication(s) filed on Apr 27, 2001 



2a) This action is FINAL. 2b) □ This action is non-final. 

3) □ Since this application is in condition for allowance except for fornnal matters, prosecution as to the nnerits is 

closed in accordance with the practice under Ex parte Qu^]^35 CD. 1 1; 453 O.G. 213. 

Disposition of Claims 

4) m Claim(s) 1-26 's/are pending in the applica 

4a) Of the above, claim(s) ^ 's/are withdrawn from considera 

5) □ Claim(s) ^ ~ 'S/are allowed. 

6) m Claim(s) J^26 . *s/are rejected. 

7) □ Claim(s) . 's/a^e objected to. 

8) □ Claims are subject to restriction and/or election requirem 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are objected to by the Examiner. 

11) 0 The proposed drawing correction filed on is: aP approved b)ndisapproved. 

12) n The oath or declaration is objected to by the Examiner. 

Priority under 35 U.S.C. § 119 

13) 0 Acknowledgement is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d). 
a)D All b) □ Some* c) Dslone of: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No 



3 □ Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
*See the attached detailed Office action for a list of the certified copies not received. 

14) 0 Acknowledgement is made of a claim for domestic priority under 35 U.S.C. § 119(e). 
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DETAILED ACTION 
Remarks 

1. Applicant's amendment dated Apr. 27, 2001, responding to the Feb. 1, 2001, 

Office action provided in the rejection of all originally pending claims, claims 1-24. Claims 1, 

3, 6, 9-12, and 15 have been amended. New claims 25 and 26 are added. Clauns 1-26 are 
now pending in this application and which have been fully considered by the examiner. 
However, Applicant arguing for the claims are patentable over the Van Hojf{See pages 10-14 
of the amendment) primarily based on (1) Van Hoff fails to teach distribution of an intrusion 
detection program and accordingly does not anticipate now amended claims (Re Claims 1,2, 

4, and 6-8), wherein distribution of such a specific name/application program, an intrusion 
detection program, would be an obvious variation and/or a design of choice of such 
distributions of a program per se, as once taught by Van Hoff (Emphasis added). In other 
words, regradless whether a distributed program is an intrusion detection program or a food 
ordering program, it is an application program or a program being distributed. And (2) among 
other amended claims and challenges of the examiner's common wisdom practice/Official 
Notice taken, as will be addressed under Prior Art's Arguments - Rejections section at item 2 
below. Thus, Applicant's amendment is not persuasive and necessitated the new ground(s) of 
rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. 
See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 
37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
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MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened statutory 
period will expire on the date the advisory action is mailed, and any extension fee pursuant to 
37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of 
this final action. 

Prior Art's Arguments - Rejections 
2. Applicants' arguments filed on Apr. 27, 2001, has been fully considered by the 
examiner but they are not persuasive. For example, 

1) Referring to section 102 rejections, at pages 10-11, Applicants argue that Van Hoff 
does not teach distribution of an intrusion detection program as now amended, thus does not 
anticipated amended Claim 1. However, as noted above, distributing of such a specific 
name/application program, an intrusion detection program, is no different from distributing, 
e.g., a food ordering program and/or a software application program per se as once taught by 
Van Hoff. Accordingly, distributing of such an intrusion detection program would be an 
obvious variation of prior art. As to amended claim 3, Applicants argue that Van Hoff fails to 
teach aging the first program, such that, for example, the program determines when it may be 
in need of updating ! (Re page 10, 3rd. paragraph). However, Applicants argue for an 
unclaimed merit of distinction, even as now amended, there is no such determines in the 
claim, thus argument is moot and not persuasive. As to amended claim 15, Applicants argue 
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that there is no teaching in Van Hoff for automatically downloading an update for a program 
from a web site. The examiner reasserts that, as noted in last Office action and recited by the 
Applicants that Van Hqff, col. 12:63 to col. 13:6, does indeed teach such claimed limitation 
through "...a content provider can store a web-site, together with all related data , in a channel 
(application/program). . . " . 

2) Referring to section 103 rejections, at pages 11-14, as to amended claim 9, 
Applicants contend that Van Hoff merely teaches the use of a "holding space" to "store data 
received as part of updates replies" for avoiding update data may corrupt during transaction 
but does not suggest "restoring a first (old) version of a program for operation", which 
examiner disagree. The examiner's position, as noted in last Office action, is that Van Hoff 
provides a means and/or suggestion so that data (first version) can be restored as the update 
reply commands are not immediately applied because "modification of program code or data 
may corrupt charmel application 153 if that application is running at the time of the updates" 
{See Van Hoff, col. 9:19-22, so as acknowledged by the Applicants (page 11)) and in addition 
Van Hoff Silso teaches "...the updating of channel data 161 from the holding space 155 is a 
transactional operation which means that it can be interrupted at any time without corrupting 
channel data 161 (first version)" (See col. 9:26-29). In other words, channel data 161 (first 
version) remains intact so that for whatever the cause(s) that the update version is inoperable, 
then it is a common wisdom practice that to restore the old/first, channel data 161, version, 
otherwise Van Hoff system, as a whole, is inoperative (emphasis added). Applicants also have 
attempted to challenge the examiner's common wisdom practice/Official Notice; however, 
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Applicants have not provided adequate information or argument so that on its face it creates a 
reasonable doubt regrading the circumstances justifying the Official Notice. Therefore, the 
presentation of a reference to substantiate the Official Notice is not deemed necessary. The 
examiner's taking of common v^isdom practice/Official Notice has been maintained. See In re 
Boon, 169 USPQ 231(CCPA 1971). 

As to amended claims 10-13, the examiner's position is maintained as set forth in last 
Office action. Applicants again have attempted to challenge the examiner intends to take 
Official Notice; however. Applicants have not provided adequate information or argument so 
that on its face it creates a reasonable doubt regrading the circumstances justifying the Official 
Notice. Therefore, the presentation of a reference to substantiate the Official Notice is not 
deemed necessary. The examiner intends to take Official Notice has been maintained. See In 
re Boon, 169 USPQ 231(CCPA 1971). 

Information Disclosure Statement (IDS) 
3. Referring to the IDS paper no. 2, filed Mar 8, 1999, in particular, non-patent 
documents listed on pages 2-10 which appears to provide with more background information 
of intrusion detection art per se which subject matters already hav e been acknowledeed by the 
Applicant at pages 2-3 of the specification , as noted in last Office action, and which Applicant 
respectfully declines to comment on these arts with relevant aspect to the claimed invention. 
Since the claimed instant application invention only direct toward a manner of a method, a . 
system for dynamically distributing updates of a program per se in a network, e.g., updating a 
program or an intrusion program in response to an automated/timed event, regardless of any 
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details of such an intrusion detection system and/or detection intrusion signatures or techniques 
would have been implemented in such distributing, updates, program systems. Thus, non- 
patent documents listed on the IDS, paper no. 2, in particular at pages 2-10 now being 
considered for the claimed merit of distributing and/or updating program subject matters only 
and not for, or regardless, unclaimed intrusion detection system and/or techniques per se, as 
Applicant acknowledged. 

Claim Rejections - 35 USC § 103 

4. Claims 1-24 and added new claims 25-26 finally rejected, as amendment necessitated 
the new ground(s) of rejection presented in this Office action in light of the reasons set forth in 
the prior art's arguments-rejections at item 2 above. 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

6. Claims 1-26 are rejected under 35 U.S.C. 103(a) as being unpatentable over Van Hoff 
et al '5,919,247' (hereinafter Van Hoff) in view of common wisdom practice in the art, or well 
known art (intrusion detection per se - Re page 2:32 to page 3:9 of the specification). 

As to claim 1, as noted in item 2 above the amended claim 1 now called for updating a 
specific software program name , an intrusion detection program (which is a software program 
per se, regardless whether it is a food ordering program or an intrusion detection program it is 
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just a name of a software program ), as pointed out in last Office action, Van discloses a 
system and method for distributing (updating) software applications and data to clients over a 
connection based network (See FIGs. lA, Abstract and at col. 2:50-67), wherein channels 
(applications/programs) can be downloaded and/or updated automatically at regular intervals 
(automated/timed event) by the tuner (client application). And in that Van teachings 
including the steps of: 

"m response to an automated event, automatically downloading... any update for the 
...program" (E.g., see FIGs. lA-lE and associated text; and at col. 3:10-13 which states "At 
regular intervals (automated event) the tuner can re-establish a connection to the transmitter 
(server component) from which the channel was obtained and check... If changes are detected, 
these changes are downloaded and installed automatically"); 

"installing a downloaded update to generate a second version of the... program" (E.g., 
again see FIG. IB channel data 161 and associated text, e.g., at col. 4:52-57); and 

"operating the second version... in place of the first version at the network site" (E.g., 
again see channel data 161, as noted above). 

Van Hoff does not specifically disclose an "intrusion detection" program. However, as 
noted above, it would become apparent to one skilled in the pertinent art at the time of the 
invention was made to recognize that the mere fact of an intended specific software program 
name being used and/or implemented as an intrusion detection program is no different from 
just a typical software program that once taught by Van Hqff, thus, accordingly using a 
program name as an intrusion detection program would also have been obvious. 
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As to claim 2, Van Hqff slso discloses ''the automated event is a timed event'" (E.g., 
see col. 5:14-16, as tuner process 152 using a timer, and also as noted above). Thus, 
accordingly it would also have been obvious. 

As to claim 3, as applied and set forth in claim 1 above, Van Hqffalso discloses "aging 
the first version of the program" (E.g., see FIG. 6B step 615 determine delay until next update 
and associated text, e.g., at col. 10:24-25); and "the timed event,,. reaching a specified age'' 
(E.g., see col. 10:31-32, as delay default value is 0 minutes). Thus, accordingly it would also 
have been obvious. 

As to claim 4, Van Hoffslso discloses "the specified age is less than or equal to 
twenty -four hours" (E.g., again see delay default value as noted above). Thus, accordingly it 
would also have been obvious. 

As to claim 5, Van Hoff also discloses "the timed event occurs at least once a day" 
(E.g., again see delay default value as noted above). Thus, accordingly it would also have 
been obvious. 

As to claim 6, Van HoffdXso discloses such claimed limitations as noted in clahn 1 
above (E.g., again see col. 3:10-13). Thus, accordingly it would also have been obvious. 

As to claim 7, Van HoffdXso discloses "encrypted format" (E.g., see col. 12:38-41) and 
such a "decrypting" step is deemed to be inherent in Van Hoffsysitm. In order to install 
and/or use the, encrypted, downloaded update data, Van Hqff sysitm must decrypting the 
downloaded update data prior to installation, otherwise inoperative. Thus, accordingly it 
would also have been obvious. 
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As to claim 8, Van Hqffdilso discloses "authenticating" (E.g., again see col. 12:38-46). 
Thus, accordingly it would also have been obvious. 

As to claim 9, as applied and set forth in claim 1 above, Van Hqff docs not explicitly 
disclose "'restoring the first (old) version''. However, Van Hoffalso discloses the use of a 
holding space 155 (See FIG. IB and associated text, e.g. at col. 9) for avoiding update data 
may corrupt during transaction (as noted above in item 2). Thus, it would become apparent to 
one skilled in the pertinent art at the time of the invention was made to recognize that when 
such an update data (second version) is inoperable, for whatever the cause(s), then it is a 
common wisdom practice to restore the old, current operational data (first version) so that the 
system would maintain in operatively mode otherwise inoperative, and which Van //oj^ already 
provides a means so that data can be retrieved and used (as noted above in item 2). 
Accordingly, it, restoring limitation, would also have been obvious. 

As to claim 10, as applied and set forth in claim 1 above. Van Hoff docs not explicitly 
disclose ''distributing the download update to a disparate network site operating the first 
version''. However, it would become apparent to one skilled in the pertinent art at the time of 
the invention was made to recognize that, concurrence operating (version) integrity is typically 
being maintained in a network, as common wisdom practice. Thus, at a regular interval as in 
Van Hoff, once such changes of a channel (first version) has been detected, as noted above, 
theses changes (update or second version) would also have been provided and/or distributed to 
other members (disparate network site) in the network that currently operating with the first 
version. Accordingly, distributing the changed or second version, as enforcing, to other 
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network's members (disparate network sites) would also have been obvious. 

As to claim 11, as applied and set forth in claim 1 above, such claimed limitations also 
have been addressed and/or coverd as set forth in claims 9 & 10 above. 

As to claim 12, as applied and set forth in claim 1 above. Van Hqff does not explicitly 
disclose ''broadcasting over a network an update message". However, Van Hoffalso suggests 
such broadcasting features as an equivalent method (See Abstract). Moreover, such a 
broadcast distribution of software over a connection based network feature is well known in 
the computer software update, upgrade, and/or remote installation art. Thus, it would also 
become apparent to one skilled in the pertinent art at the time of the invention was made to 
utilize of such broadcasting feature, as claimed, in the update method that once taught by Van 



As to claim 13, as applied to claim 12 above, such ''recovery event'" (restoring) also 
have been addressed and/or covered as set forth in claim 9 above. 

As to claim 14, as applied to claim 1 above, Van Hoff does not explicitly disclose "the 
program is a set of instruction detection signatures for an intrusion detection sensor'" . 
However, such an intrusion detection program per se, as noted in item 3 above, IDS section, 
which a claimed limitation is well known in the computer security art as also acknowledged by 
the Applicant (See background art at pages 2:32 to page 3:9 of the specification). Thus, it 
would also become apparent to one skilled in the pertinent art at the time of the invention was 
made to implement and/or applying Van //<9j^ teachings for such a typical known intrusion 
detection application, as in prior art, since Van //Oj^ teachings regardless of what application 



Hoff. 
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program (chamiel) being updated. 

As to claim 15, as applied and set forth in claim 1 above, Van Hoffdlso discloses "the 
remote site is an Internet web page" (E.g., see FIG. IB Web browser 151 and associated text, 
e.g., at col. 12:63 to col. 13:6). Thus, accordingly it would also have been obvious. 

As to claims 16-21, this is another version of the method claimed discussed above, 
claims 1-6 & 14, wherein all claimed limitations also have been addressed and/or covered as 
set forth above. Thus, the same rationales provided in the rejection of claims 1-6 & 14 above 
are also applied and incorporated herein. 

As to claims 22-24, this is an apparatus version of the method claimed discussed above, 
claims 1, 2 & 14, wherein all claimed limitations also have been addressed and/or covered as 
set forth above. Thus, the same rationales provided in the rejection of claims 1, 2 & 14 above 
are also applied and incorporated herein. 

As to claim 25, as applied to claim 14 above, Van Hoffdoos not explicitly disclose 
''instruction detection signatures comprise patterns of network activity that indicate 
unauthorized access'\ However, again such an intrusion detection program per se, as noted in 
item 3 above, IDS section, which a claimed limitation is also well known in the computer 
security art as also acknowledged by the Applicant (See background art at pages 2:32 to page 
3:9 of the specification). Thus, it would also become apparent to one skilled in the pertinent 
art at the time of the invention was made to implement and/or applying Van //oj^^ teachings for 
such a typical known intrusion detection application, as in prior art, since Van //qj^^ teachings 
regardless of what application program (channel) being updated. 
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As to claim 26, as applied to claim 13 above, such claimed limitations also has been 
addressed and/or covered as set forth in claim 13 above. 



7. The background art of interest is cited by the examiner. Any inquiry concerning 

this communication or earlier communications from the examiner should be directed to Mr. 

Tuan Dam whose telephone number is (703) 305-4552. The examiner can normally be 

reached on Tuesday-Friday from 7:30 AM to 5:00 PM. The examiner can also be reached on 

alternate Mondays. If attempts to reach the examiner by telephone are unsuccessful, the 

examiner's supervisor, Mr. Mark R. Powell, can be reached on (703) 305-9703. 

Any response to this Final action should be mailed to: 
Box AF 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 
or faxed to: 

(703) 308-9051, (for formal communications; please mark "EXPEDITED 
PROCEDURE") 

Or: 

(703) 308-5357 (for informal or draft communications, please label 

"PROPOSED" or "DRAFT") 
Hand-delivered responses should be brought to Crystal Park II, 2121 Crystal Drive, 
Arlington. V A., 22202. Sixth Floor (Receptionist). 



Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the Group receptionist whose telephone number is (703) 305- 



Conclusion 



3900. 



07/19/01 




TUAN Q. DAM 
PRIMARY EXAMINER 



